glupteba

Sharing

Copy URL

Twitter E-mail

General

Target

10fe1805921ccea2cce4b75338b8024698067c54ff1590e747915885e491fa9b
Size

1.0MB
Sample

210904-q1hbkshdcr
MD5

845e27c1b9c85259e43364ffe45b9f44
SHA1

f1b40b61d256717a866b60332fb25b9e45ce3684
SHA256

10fe1805921ccea2cce4b75338b8024698067c54ff1590e747915885e491fa9b
SHA512

38a1441efd0e1f5c9cf29c61be5467e05d310b77ceca5f883482968142e822b94755e6570b04fa82d9ac0b23a9349164cdb62bf43bebd6a5f77c865ef87c0423

Malware Config

Extracted

Family

redline

Botnet

test

45.14.49.169:22411

Extracted

Family

raccoon

Botnet

b8ef25fa9e346b7a31e4b6ff160623dd5fed2474

Attributes

url4cnc
https://telete.in/iphbarberleo

rc4.plain

Extracted

Family

redline

Botnet

big_tastyyy

87.251.71.44:80

Extracted

Family

redline

Botnet

testnewinstalls

45.129.236.6:21588

Extracted

Family

redline

Botnet

NORMAN3

45.14.49.184:28743

Extracted

Family

vidar

Version

40.4

Botnet

937

https://romkaxarit.tumblr.com/

Attributes

profile_id
937

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

smokeloader

Version

2020

http://fioajfoiarjfoi1.xyz/

http://rdukhnihioh2.xyz/

http://sdfghjklemm3.xyz/

http://eruiopijhgnn4.xyz/

http://igbyugfwbwb5.xyz/

http://shfuhfuwhhc6.xyz/

http://ersyglhjkuij7.xyz/

http://ygyguguuju8.store/

http://resbkjpokfct9.store/

http://sdfygfygu10.store/

http://hbibhibihnj11.store/

http://vfwlkjhbghg12.store/

http://poiuytrcvb13.store/

http://xsedfgtbh14.store/

http://iknhyghggh15.store/

http://wnlonevkiju16.site/

http://gfyufuhhihioh17.site/

http://nsgiuwrevi18.site/

http://oiureveiuv19.site/

http://ovrnevnriuen20.site/

rc4.i32

Extracted

Family

vidar

Version

40.4

Botnet

898

https://romkaxarit.tumblr.com/

Attributes

profile_id
898

Targets

- Target
  
  10fe1805921ccea2cce4b75338b8024698067c54ff1590e747915885e491fa9b
- Size
  
  1.0MB
- MD5
  
  845e27c1b9c85259e43364ffe45b9f44
- SHA1
  
  f1b40b61d256717a866b60332fb25b9e45ce3684
- SHA256
  
  10fe1805921ccea2cce4b75338b8024698067c54ff1590e747915885e491fa9b
- SHA512
  
  38a1441efd0e1f5c9cf29c61be5467e05d310b77ceca5f883482968142e822b94755e6570b04fa82d9ac0b23a9349164cdb62bf43bebd6a5f77c865ef87c0423
Score

10^/10

raccoon redline b8ef25fa9e346b7a31e4b6ff160623dd5fed2474 big_tastyyy test testnewinstalls discovery evasion infostealer stealer themida trojan glupteba metasploit smokeloader vidar 898 937 norman3 backdoor dropper loader suricata
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba Payload
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
  suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
  suricata
- suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
  suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
  suricata
- suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
  suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
  suricata
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Vidar Stealer
  stealer
- Downloads MZ/PE file
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Install Root Certificate

T1130

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Glupteba Payload

MetaSploit

Modifies Windows Defender Real-time Protection settings

Process spawned unexpected child process

Raccoon

RedLine

RedLine Payload

SmokeLoader

Vidar

suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Vidar Stealer

Downloads MZ/PE file

Executes dropped EXE

Checks BIOS information in registry

Checks computer location settings

Loads dropped DLL

Themida packer

Checks installed software on the system

Checks whether UAC is enabled

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2

behavioral3